Directory Traversal Vulnerability in BackWPup Plugin for WordPress by Inpsyde

CVE-2023-5504

Summary

The BackWPup plugin for WordPress, produced by Inpsyde, contains a Directory Traversal vulnerability allowing authenticated attackers to store backups in arbitrary folders on the server. This issue affects versions up to and including 4.0.1, enabling attackers to manipulate the Log File Folder settings. Unless already present, running the first backup job can create an index.php and a .htaccess file in the chosen backup directory, which could result in potential denial of service for other sites hosted on the same server. The implications of this vulnerability necessitate immediate attention for users and administrators of the affected plugin.

References